The PairOps Platform holds the operating record of a licensed cannabis company: obligations, licenses, training, incidents, and the money around them. This page explains how that record is kept safe.
Six properties of the Platform, each enforced by the system rather than by policy alone.
Every record belongs to exactly one company, and the database itself enforces that boundary on every query through row-level security. The boundary lives in the storage layer, so a bug in the application code can't route around it. One company can never read another's records.
A company's owner decides who joins it. People come into a company by invitation only, and each person carries a role and per-module permissions. The server checks them on every request, and the interface only hides what the server already refuses. Board-level reports require owner or admin authority, and everyone can always see the work assigned to them.
Every connection runs over TLS 1.2 or newer, and all stored data is encrypted at rest with AES-256. The most sensitive fields, including cost models, capital records, incident details, and employee credential numbers, are encrypted a second time at the application layer with versioned, rotatable keys held in a separate vault.
AI on the Platform drafts documents and reads files for a person to review. It never takes autonomous action on a compliance, financial, or personnel decision, and when it can't verify something, it flags the gap for a person to check.
Your data never trains AI models and is never shared with another company. Every AI feature carries a daily usage cap.
Values the Platform doesn't recognize are refused with a clear error. If a rate limiter or safety check can't complete, the request is denied. Regulatory content enters the Platform only through human review. Content that loses its verified status is pulled automatically, and if that process ever fails, it's treated as a compliance incident and alerts the team right away.
Acknowledgments are append-only. Completions carry who did the work and when. Only an owner can reopen a closed period, and the reopening is recorded. Audit exports list document names and dates while the underlying files stay behind expiring, signed links.
The Platform runs on SOC 2 Type II certified cloud infrastructure with automated, encrypted daily backups.
Write to the security desk and a person will answer.